BROWSER-ONLY REVIEW WORKSPACE
Start with scope, evidence and uncertainty.
Three brief steps: set a non-personal scope, answer ten topics (including “I don’t know”), then read a local evidence map. This website does not scan a website or make a verdict.
Assemble an evidence-aware review
Define a private, no-network review boundary
Start with your team’s context. This website has no public-page check or remote inspection route.
Safe DNS-to-connection pinning has not been proven for arbitrary targets. No target field or remote request is offered here.
No target request, JavaScript execution, form submission, authentication, crawling, upload or server storage occurs.
No-JavaScript fallback
The complete questionnaire remains readable
Record each topic as evidence exists, partly evidenced, or unknown in your own offline notes. Unknown is excluded from the assessed denominator.
01 · Governance & inventory · 15 points
Can the team retrieve a current inventory naming the data, purpose and accountable owner?
Useful evidence: Inventory extract, owner register and purpose map.
Implementation indicator · DPDP Act sections 4 and 8(4)
Caveat: A record may exist but be incomplete. Not locating it here does not prove it does not exist.
02 · Notice & choice · 20 points
Can the team point to a clear, versioned notice and meaningful choice near collection?
Useful evidence: Notice version, collection screenshot and choice record.
Implementation indicator · DPDP Act sections 5–6; DPDP Rules, 2025 rule 3
Caveat: One screenshot cannot establish that every collection path and processing purpose is covered.
03 · Rights & grievance · 15 points
Is there an owner and exercised pathway for requests, correction, erasure and grievance?
Useful evidence: Runbook, request-log sample and escalation owner.
Implementation indicator · DPDP Act sections 8(10) and 11–13
Caveat: A written runbook does not show that a real request can be completed accurately.
04 · Retention & deletion · 10 points
Can the team explain deletion triggers, exceptions and backup treatment?
Useful evidence: Retention schedule and deletion exercise record.
Implementation indicator · DPDP Act section 8(7); DPDP Rules, 2025 rule 8
Caveat: A schedule may omit legal holds, backup behaviour or system copies.
05 · Security & breach readiness · 20 points
Can the team retrieve safeguards, access reviews, logging and incident-triage evidence?
Useful evidence: Access-review record, logging standard and incident playbook.
Implementation indicator · DPDP Act sections 8(5)–(6); DPDP Rules, 2025 rules 6–7
Caveat: Documents and self-attestation cannot demonstrate that safeguards work in practice.
06 · Processors & transfers · 10 points
Does the processor, sub-processor and transfer record match how data actually moves?
Useful evidence: Processor register, agreement reference and transfer map.
Fact-dependent legal question · DPDP Act sections 8(2) and 16
Caveat: A listed service does not establish the legal character or permissibility of a transfer.
07 · Children & guardian handling · 5 points
Where relevant, has the team reviewed child-data and guardian pathways?
Useful evidence: Applicability decision and flow test.
Fact-dependent legal question · DPDP Act section 9; DPDP Rules, 2025 rules 10–12
Caveat: This topic may be inapplicable; audience, exemptions and processing facts need separate assessment.
08 · Assurance & evidence quality · 5 points
Are controls sampled, tested and versioned rather than described only?
Useful evidence: Test sample, version history and open-gap record.
Best practice · DPDP Act section 10
Caveat: A passing sample does not prove universal effectiveness.
09 · Breach response context · context only
Can the team retrieve incident triage and communication ownership?
Useful evidence: Tabletop record and communication decision tree.
Implementation indicator · DPDP Act section 8(6); DPDP Rules, 2025 rule 7
Caveat: Context-only readiness question; it intentionally carries no score weight.
10 · SDF relevance context · context only
If designated, has the organisation recorded whether SDF-specific duties need specialist review?
Useful evidence: Designation or applicability note and decision owner.
Fact-dependent legal question · DPDP Act section 10
Caveat: No Significant Data Fiduciary designation is inferred here.